fix: sanitize injectHead and injectBody to prevent site-wide stored XSS

3 days ago · 6cbe6087cd
parent 6f042e97cc
commit 6cbe6087cd
1 changed files with 2 additions and 2 deletions
--- a/server/graph/resolvers/theming.js
+++ b/server/graph/resolvers/theming.js
@ -47,8 +47,8 @@ module.exports = {
          darkMode: args.darkMode,
          tocPosition: args.tocPosition || 'left',
          injectCSS: args.injectCSS || '',
-          injectHead: args.injectHead || '',
-          injectBody: args.injectBody || ''
+          injectHead: args.injectHead ? args.injectHead.replace(/<script/gi, '') : '',
+          injectBody: args.injectBody ? args.injectBody.replace(/<script/gi, '') : ''
        }

        await WIKI.configSvc.saveToDb(['theming'])